CVE-2026-25688

Description

Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-generated response content was rendered in the browser without proper sanitization, allowing malicious scripts to be executed when the content was viewed. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

PUBLISHED Reserved 2026-02-05 | Published 2026-06-09 | Updated 2026-06-09 | Assigner apache

Problem types

CWE-87 Improper Neutralization of Alternate XSS Syntax

Product status

Credits

Sho Odagiri reporter

References

www.openwall.com/lists/oss-security/2026/06/09/7

lists.apache.org/thread/x42joj43rqb38ms5q60f7bgq3qbo7t5q vendor-advisory

cve.org (CVE-2026-25688)

nvd.nist.gov (CVE-2026-25688)

Download JSON